CVE-2017-6145: f5 networks, inc. f5 big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafe Insufficient Session Expiration

Vulnerability summary

CVE-2017-6145 is a high (CVSS 7.5) Insufficient Session Expiration vulnerability in f5 networks, inc. f5 big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafe. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 64% of scored vulnerabilities.

Timeline

1. 20-10-2017
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."